@lotics/cli 0.86.0 → 0.86.2

package/dist/src/cli.js

@@ -29960,6 +29960,9 @@ var LoticsClient = class {
     if (opts.knowledge !== void 0 && opts.knowledge.length > 0) {
       params.set("knowledge", JSON.stringify(opts.knowledge));
     }
+    if (opts.config !== void 0) {
+      params.set("config", JSON.stringify(opts.config));
+    }
     const query = params.toString();
     return this.request(
       "GET",
@@ -29992,6 +29995,9 @@ var LoticsClient = class {
     if (opts.knowledge !== void 0 && opts.knowledge.length > 0) {
       params.set("knowledge", JSON.stringify(opts.knowledge));
     }
+    if (opts.config !== void 0 && opts.config.length > 0) {
+      params.set("config", JSON.stringify(opts.config));
+    }
     if (opts.renames !== void 0 && opts.renames.length > 0) {
       params.set("renames", JSON.stringify(opts.renames));
     }
@@ -31598,7 +31604,13 @@ function buildWrapperPage(args) {
 
       // The iframe SDK sends one "upload" op carrying a File. A File can't
       // cross the JSON /_rpc hop, so the upload runs here in the browser:
-      // mint a presigned URL, PUT the bytes to storage, then finalize.
+      // mint an upload URL, PUT the bytes, then finalize.
+      //
+      // In dev the minted URL is same-origin (/_upload/<file_id>) \u2014 the dev
+      // server relays the bytes to storage on our behalf, because the prod
+      // bucket's CORS does not admit a localhost origin. Production PUTs the
+      // presigned storage URL directly. Same three lines either way: the page
+      // PUTs wherever the mint points.
       //
       // Retry policy parity with the production SDK
       // (packages/app-sdk/src/upload/transport.ts): 3 PUT attempts with
@@ -31803,6 +31815,85 @@ function escapeHtml2(s) {
   return s.replace(/&/g, "&amp;").replace(/</g, "&lt;").replace(/>/g, "&gt;");
 }
 
+// src/dev/upload_relay.ts
+var PRESIGN_TTL_MS = 15 * 60 * 1e3;
+function createUploadRelay(now = Date.now) {
+  const minted = /* @__PURE__ */ new Map();
+  const prune = (at) => {
+    for (const [id, entry] of minted) {
+      if (at - entry.mintedAt > PRESIGN_TTL_MS) minted.delete(id);
+    }
+  };
+  return {
+    rewriteMint(result) {
+      const mint = result;
+      if (typeof mint?.file_id !== "string" || typeof mint?.upload_url !== "string") return result;
+      const at = now();
+      prune(at);
+      minted.set(mint.file_id, { url: mint.upload_url, mintedAt: at });
+      return { ...mint, upload_url: `/_upload/${encodeURIComponent(mint.file_id)}` };
+    },
+    destinationFor(fileId) {
+      const entry = minted.get(fileId);
+      if (!entry) return null;
+      if (now() - entry.mintedAt > PRESIGN_TTL_MS) {
+        minted.delete(fileId);
+        return null;
+      }
+      return entry.url;
+    },
+    settle(fileId) {
+      minted.delete(fileId);
+    },
+    size: () => minted.size
+  };
+}
+
+// src/dev/file_relay.ts
+import { createHash } from "node:crypto";
+var TTL_MS = 24 * 60 * 60 * 1e3;
+var MAX_ENTRIES = 5e3;
+var PRESIGNED_KEYS = /* @__PURE__ */ new Set(["url", "thumbnail_url", "preview_url"]);
+var isFileObject = (o) => typeof o.filename === "string" && typeof o.mime_type === "string";
+var isRemoteUrl = (v) => typeof v === "string" && /^https?:\/\//i.test(v);
+function createFileRelay(wrapperOrigin, now = Date.now) {
+  const seen = /* @__PURE__ */ new Map();
+  const tokenFor = (url2) => createHash("sha256").update(url2).digest("hex").slice(0, 24);
+  const remember = (url2) => {
+    const token = tokenFor(url2);
+    seen.set(token, { url: url2, at: now() });
+    if (seen.size > MAX_ENTRIES) {
+      const oldest = seen.keys().next();
+      if (!oldest.done) seen.delete(oldest.value);
+    }
+    return token;
+  };
+  const walk2 = (node) => {
+    if (Array.isArray(node)) return node.map(walk2);
+    if (!node || typeof node !== "object") return node;
+    const obj = node;
+    const file2 = isFileObject(obj);
+    const out = {};
+    for (const [key, value] of Object.entries(obj)) {
+      out[key] = file2 && PRESIGNED_KEYS.has(key) && isRemoteUrl(value) ? `${wrapperOrigin}/_file/${remember(value)}` : walk2(value);
+    }
+    return out;
+  };
+  return {
+    rewrite: (result) => walk2(result),
+    destinationFor(token) {
+      const entry = seen.get(token);
+      if (!entry) return null;
+      if (now() - entry.at > TTL_MS) {
+        seen.delete(token);
+        return null;
+      }
+      return entry.url;
+    },
+    size: () => seen.size
+  };
+}
+
 // src/dev/server.ts
 var DEFAULT_PORT = 5174;
 var DEFAULT_VITE_PORT = 5173;
@@ -31849,6 +31940,24 @@ async function startDevServer(args) {
     }
   };
   process.once("exit", killViteOnExit);
+  const uploads = createUploadRelay();
+  const wrapperOrigin = `http://localhost:${wrapperPort}`;
+  const viteOrigin = `http://localhost:${vitePort}`;
+  const files = createFileRelay(wrapperOrigin);
+  const fileCors = {
+    "Access-Control-Allow-Origin": viteOrigin,
+    "Access-Control-Allow-Headers": "range, content-type",
+    "Access-Control-Expose-Headers": "content-length, content-range, accept-ranges, content-type, content-disposition, etag"
+  };
+  const PASS_THROUGH = [
+    "content-type",
+    "content-length",
+    "content-range",
+    "accept-ranges",
+    "etag",
+    "last-modified",
+    "content-disposition"
+  ];
   const server = http.createServer(async (req, res) => {
     const url2 = req.url ?? "/";
     const pathname = url2.split("?")[0];
@@ -31877,7 +31986,11 @@ async function startDevServer(args) {
         process.stderr.write(`[rpc] ${body.op} ${ms}ms
 `);
         res.writeHead(200, { "Content-Type": "application/json" });
-        res.end(serializeRpcResult(result));
+        res.end(
+          serializeRpcResult(
+            body.op === "upload_url" ? uploads.rewriteMint(result) : files.rewrite(result)
+          )
+        );
       } catch (err2) {
         const message = err2 instanceof Error ? err2.message : String(err2);
         process.stderr.write(`[rpc] ERROR ${message}
@@ -31930,12 +32043,115 @@ async function startDevServer(args) {
       }
       return;
     }
+    if (pathname.startsWith("/_file/")) {
+      if (req.method === "OPTIONS") {
+        res.writeHead(204, fileCors);
+        res.end();
+        return;
+      }
+      if (req.method !== "GET" && req.method !== "HEAD") {
+        res.writeHead(405, { ...fileCors, Allow: "GET, HEAD, OPTIONS" });
+        res.end();
+        return;
+      }
+      const token = decodeURIComponent(pathname.slice("/_file/".length));
+      const destination = files.destinationFor(token);
+      if (!destination) {
+        process.stderr.write(`[file] ERROR unknown or expired token ${token}
+`);
+        res.writeHead(404, { ...fileCors, "Content-Type": "application/json" });
+        res.end(JSON.stringify({ message: "No file for this token" }));
+        return;
+      }
+      try {
+        const range = req.headers.range;
+        const upstream = await fetch(destination, {
+          method: req.method,
+          headers: range ? { Range: range } : void 0
+        });
+        const headers = { ...fileCors };
+        for (const name of PASS_THROUGH) {
+          const value = upstream.headers.get(name);
+          if (value) headers[name] = value;
+        }
+        const size = headers["content-length"] ?? "?";
+        process.stderr.write(`[file] ${token} ${upstream.status} ${size}B
+`);
+        res.writeHead(upstream.status, headers);
+        if (req.method === "HEAD" || !upstream.body) {
+          res.end();
+          return;
+        }
+        const reader = upstream.body.getReader();
+        for (; ; ) {
+          const { value, done } = await reader.read();
+          if (done) break;
+          res.write(Buffer.from(value));
+        }
+        res.end();
+      } catch (err2) {
+        const message = err2 instanceof Error ? err2.message : String(err2);
+        process.stderr.write(`[file] ERROR ${token} ${message}
+`);
+        if (!res.headersSent) {
+          res.writeHead(502, { ...fileCors, "Content-Type": "application/json" });
+          res.end(JSON.stringify({ message }));
+        } else {
+          res.end();
+        }
+      }
+      return;
+    }
+    if (req.method === "PUT" && pathname.startsWith("/_upload/")) {
+      const fileId = decodeURIComponent(pathname.slice("/_upload/".length));
+      const destination = uploads.destinationFor(fileId);
+      if (!destination) {
+        process.stderr.write(`[upload] ERROR unknown or expired file_id ${fileId}
+`);
+        res.writeHead(404, { "Content-Type": "application/json" });
+        res.end(JSON.stringify({ message: `No presigned upload pending for ${fileId}` }));
+        return;
+      }
+      try {
+        const chunks = [];
+        for await (const chunk of req) chunks.push(chunk);
+        const bytes = Buffer.concat(chunks);
+        const startedAt = Date.now();
+        const upstream = await fetch(destination, {
+          method: "PUT",
+          body: bytes,
+          headers: { "Content-Type": req.headers["content-type"] ?? "application/octet-stream" }
+        });
+        const ms = Date.now() - startedAt;
+        if (upstream.ok) {
+          uploads.settle(fileId);
+          process.stderr.write(`[upload] ${fileId} ${bytes.length}B ${ms}ms
+`);
+        } else {
+          process.stderr.write(`[upload] ERROR ${fileId} storage returned ${upstream.status}
+`);
+        }
+        res.writeHead(upstream.status);
+        res.end();
+      } catch (err2) {
+        const message = err2 instanceof Error ? err2.message : String(err2);
+        process.stderr.write(`[upload] ERROR ${fileId} ${message}
+`);
+        if (!res.headersSent) {
+          res.writeHead(502, { "Content-Type": "application/json" });
+          res.end(JSON.stringify({ message }));
+        } else {
+          res.end();
+        }
+      }
+      return;
+    }
     res.writeHead(404, { "Content-Type": "text/plain" });
     res.end("Not Found");
   });
   await new Promise((resolve2, reject2) => {
     server.once("error", reject2);
-    server.listen(wrapperPort, () => {
+    server.listen(wrapperPort, "127.0.0.1", () => {
       server.off("error", reject2);
       resolve2();
     });
@@ -50167,7 +50383,20 @@ function readLocalAppManifest(projectDir) {
       }
     }
   }
-  return { app_id, knowledge };
+  const config2 = [];
+  if (Array.isArray(lotics.config)) {
+    for (const entry of lotics.config) {
+      const result = contractConfigEntrySchema.safeParse(entry);
+      if (!result.success) {
+        const alias = isPlainObject2(entry) && typeof entry.alias === "string" ? entry.alias : "?";
+        throw new Error(
+          `Invalid lotics.config knob "${alias}" in package.json: ` + result.error.issues.map((i2) => `${i2.path.join(".") || "(root)"}: ${i2.message}`).join("; ")
+        );
+      }
+      config2.push(result.data);
+    }
+  }
+  return { app_id, knowledge, config: config2 };
 }
 function parseRenameFlags(renames) {
   return renames.map((entry) => {
@@ -50206,6 +50435,10 @@ function parseResolveFlags(resolve2) {
   return resolutions;
 }
 async function packageDoctor(client, args) {
+  if (args.app_id !== void 0 && args.app_id.startsWith("apg_")) {
+    await contentDoctor(client, args.app_id);
+    return;
+  }
   const app_id = resolveInstallationAppId(args.app_id);
   const health = await client.getPackageHealth(app_id);
   console.error(
@@ -50425,6 +50658,38 @@ function formatTemplateResolveHint(entry) {
   const note = entry.baseline_unknown ? "   (can't verify the local edit \u2014 older package version; revert overwrites, keep retains)" : "   (a local edit \u2014 revert overwrites it with the package's version; keep retains it)";
   return `    --resolve template.${entry.alias}=revert|keep${note}`;
 }
+async function contentDoctor(client, package_id) {
+  const installation = await resolveWorkspaceContentInstallation(client, package_id);
+  const preview = await client.previewContentInstallationUpgrade(installation.id, {});
+  const name = installation.package_registry?.name ?? package_id;
+  console.error(`${name} \u2014 content installation of ${package_id} (this workspace)`);
+  console.error(
+    `  Installed: v${preview.from_version}   Latest: v${preview.to_version}` + (preview.to_version > preview.from_version ? "   \u2192 update available" : "")
+  );
+  const drifted = preview.entries.filter((e) => e.change === "drifted");
+  if (drifted.length === 0) {
+    console.error("  Binding: healthy \u2014 every bound doc resolves.");
+  } else {
+    console.error(`  Binding drift (${drifted.length}):`);
+    for (const entry of drifted) {
+      console.error(`    - knowledge.${entry.alias} "${entry.name}" (bound doc is gone)`);
+    }
+    console.error(
+      `  Resolve while upgrading:
+    lotics upgrade ${package_id} --resolve knowledge.<alias>=recreate|unbind   (or --bind-to <alias>=<kdc_id> to re-point)`
+    );
+    process.exitCode = 1;
+  }
+  const editedDocs = preview.entries.filter((e) => e.modified);
+  const editedTemplates = preview.templates;
+  if (editedDocs.length === 0 && editedTemplates.length === 0) {
+    console.error("  Content: pristine \u2014 no local edits an upgrade would ask about.");
+  } else {
+    console.error(`  Local edits (${editedDocs.length + editedTemplates.length}) \u2014 each takes a keep/overwrite consent at upgrade:`);
+    for (const entry of editedDocs) console.error(`    - knowledge.${entry.alias} "${entry.name}"`);
+    for (const entry of editedTemplates) console.error(`    - template.${entry.alias}`);
+  }
+}
 async function resolveWorkspaceContentInstallation(client, package_id) {
   const workspaceId = client.getWorkspaceId();
   if (!workspaceId) {
@@ -50782,8 +51047,9 @@ async function appPublish(client, args) {
     );
   }
   const knowledge = local && local.app_id === appId ? local.knowledge : [];
+  const config2 = local && local.app_id === appId ? local.config : [];
   const renames = parseRenameFlags(args.renames);
-  const preview = await client.previewPublishAppPackage(appId, { renames, knowledge });
+  const preview = await client.previewPublishAppPackage(appId, { renames, knowledge, config: config2 });
   const { lines, hasError } = formatExtractReport(preview.findings);
   console.error(`Publish preview \u2014 ${appId} as new package "${preview.package_name}" (v1):`);
   const groups = [
@@ -50805,6 +51071,11 @@ async function appPublish(client, args) {
   } else {
     console.error("  No renamable aliases.");
   }
+  if (config2.length > 0) {
+    console.error(
+      `  Config knobs (${config2.length}): ${config2.map((c) => `${c.alias} (${c.type})`).join(", ")}`
+    );
+  }
   if (lines.length > 0) {
     console.error(`  Findings (${preview.findings.length}):`);
     for (const line of lines) console.error(line);
@@ -50829,7 +51100,8 @@ Re-run with --yes to publish v1:`);
   const result = await client.publishAppAsPackage(appId, {
     renames,
     changelog: args.changelog ?? null,
-    knowledge
+    knowledge,
+    config: config2
   });
   console.error(`Published ${result.package_id} v${result.version} from app ${appId}.`);
   console.error(`  The app is now installation #1 \u2014 develop it in place, then release the next version:`);
@@ -50848,7 +51120,8 @@ async function appRelease(client, args) {
     );
   }
   const knowledge = local && local.app_id === appId && local.knowledge.length > 0 ? local.knowledge : void 0;
-  const preview = await client.previewPackageRelease(appId, { knowledge });
+  const config2 = local && local.app_id === appId && local.config.length > 0 ? local.config : void 0;
+  const preview = await client.previewPackageRelease(appId, { knowledge, config: config2 });
   const { lines, hasError } = formatExtractReport(preview.findings);
   console.error(`Release preview \u2014 ${appId} \u2192 ${preview.package_id} v${preview.version}:`);
   if (preview.added_aliases.length > 0) {
@@ -50857,6 +51130,16 @@ async function appRelease(client, args) {
   if (preview.changed_artifacts.length > 0) {
     console.error(`  Changed (${preview.changed_artifacts.length}): ${preview.changed_artifacts.join(", ")}`);
   }
+  if (preview.knowledge === void 0 && knowledge !== void 0) {
+    console.error(
+      "  WARNING: the server ignored the knowledge declaration (it predates bundled-knowledge releases) \u2014 the bundle will NOT change. Retry after the platform deploy completes."
+    );
+  }
+  if (preview.config === void 0 && config2 !== void 0) {
+    console.error(
+      "  WARNING: the server ignored the config declaration (it predates manifest config declarations) \u2014 the knobs will NOT change. Retry after the platform deploy completes."
+    );
+  }
   const k = preview.knowledge ?? { added: [], removed: [], changed: [] };
   if (k.added.length > 0 || k.removed.length > 0 || k.changed.length > 0) {
     const parts = [
@@ -50866,7 +51149,16 @@ async function appRelease(client, args) {
     ].filter((p) => p !== null);
     console.error(`  Knowledge: ${parts.join("; ")}`);
   }
-  if (preview.added_aliases.length === 0 && preview.changed_artifacts.length === 0 && k.added.length === 0 && k.removed.length === 0 && k.changed.length === 0) {
+  const cfg = preview.config ?? { added: [], removed: [], changed: [] };
+  if (cfg.added.length > 0 || cfg.removed.length > 0 || cfg.changed.length > 0) {
+    const parts = [
+      cfg.added.length > 0 ? `+${cfg.added.join(", ")}` : null,
+      cfg.removed.length > 0 ? `dropped ${cfg.removed.join(", ")}` : null,
+      cfg.changed.length > 0 ? `changed ${cfg.changed.join(", ")}` : null
+    ].filter((p) => p !== null);
+    console.error(`  Config: ${parts.join("; ")}`);
+  }
+  if (preview.added_aliases.length === 0 && preview.changed_artifacts.length === 0 && k.added.length === 0 && k.removed.length === 0 && k.changed.length === 0 && cfg.added.length === 0 && cfg.removed.length === 0 && cfg.changed.length === 0) {
     console.error("  No contract changes since the current version (a fresh code/dist snapshot still ships).");
   }
   if (lines.length > 0) {
@@ -50885,7 +51177,7 @@ Re-run with --yes to publish v${preview.version}:`);
     process.exitCode = 1;
     return;
   }
-  const result = await client.releasePackage(appId, { changelog: args.changelog, knowledge });
+  const result = await client.releasePackage(appId, { changelog: args.changelog, knowledge, config: config2 });
   console.error(`Released ${result.package_id} v${result.version}.`);
   console.error(`  The origin was re-pinned to v${result.version} \u2014 verify:  lotics package doctor ${appId}`);
 }
@@ -50916,7 +51208,7 @@ async function packageFleetUpgrade(client, args) {
     const line = `  [${inst.outcome}] ${inst.workspace_name} \u2014 ${inst.app_name} (${from} \u2192 v${result.target_version})`;
     if (inst.outcome === "skipped" && inst.blockers) {
       console.error(
-        `${line}: breaking=${inst.blockers.breaking} drift=${inst.blockers.drift} modified=${inst.blockers.modified}`
+        `${line}: breaking=${inst.blockers.breaking} drift=${inst.blockers.drift} modified=${inst.blockers.modified} knowledge=${inst.blockers.knowledge}`
       );
       console.error(
         `      resolve via:  lotics upgrade ${inst.app_id} --version ${result.target_version} ...`
@@ -67806,7 +68098,7 @@ COMMANDS
                                        <alias>=apply|keep|archive|recreate|unbind); an APP package
                                        FLEET-upgrades every installation across your org (clean
                                        apply, findings skip). --apply-all accepts the package's version
-  lotics package doctor [app_id]       Installation health: version pin vs latest, binding
+  lotics package doctor [app_id|package_id]  Installation health: version pin vs latest, binding
                                        drift, locally modified core, knowledge drift/edits
                                        (exit 1 on findings)
   lotics package config <app_id> [--set key=value ...]
@@ -68335,7 +68627,7 @@ async function main() {
     console.error("    lotics install <package_id> [--version N] [--bind-to <alias>=<kdc_id>] [--config key=value ...]   Install a package (app or content)");
     console.error("    lotics uninstall <app_id|package_id> [--archive-tables] [--keep-content]   Uninstall \u2014 dispatched by id (app vs content)");
     console.error("    lotics upgrade <app_id|package_id> [--version N] [--resolve <key>=... ] [--bind-to ...] [--apply-all]   Upgrade \u2014 app install / content install / whole app fleet (apg_)");
-    console.error("  lotics package doctor [app_id]                   Health: version pin vs latest + binding/knowledge drift");
+    console.error("  lotics package doctor [app_id|package_id]        Health: version pin vs latest + binding/knowledge drift (apg_ = this workspace's content install)");
     console.error("  lotics package config <app_id> [--set key=value ...]   Show or edit an installation's config knobs");
     console.error("  lotics package eject <app_id>                    Sever an installation's package link");
     console.error("  lotics package show <package_id>                 Registry metadata + version history (channel, yank, changelog)");

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@lotics/cli",
-  "version": "0.86.0",
+  "version": "0.86.2",
   "description": "Lotics SDK and CLI for AI agents",
   "type": "module",
   "bin": {